@blamejs/core 0.16.0 → 0.16.2

package/lib/auth/oauth.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * oauth — OAuth 2 / OIDC client.
@@ -959,7 +961,11 @@ async function verifyClientAttestation(attestationJwt, popJwt, vopts) {
       throw new OAuthError("auth-oauth/attestation-pop-seen-callback-failed",
         "client-attestation-pop: seenJti() callback threw: " + ((e && e.message) || String(e)));
     }
-    if (unseen === false) {
+    // Fail closed on ANY non-truthy result. The contract is "returns truthy
+    // when UNSEEN"; an operator store fronting Redis EXISTS / SISMEMBER or a
+    // SQL COUNT returns 0 (falsy, not `false`) on a replay, so an
+    // `=== false` comparison would miss it and accept the replayed PoP.
+    if (!unseen) {
       throw new OAuthError("auth-oauth/attestation-pop-replay",
         "client-attestation-pop: jti already seen (replay refused, draft §12.1)");
     }
@@ -980,6 +986,47 @@ function _constantTimeStrEq(a, b) {
   return cryptoTimingSafeEqual(a, b);
 }
 
+// Framework-managed authorization-request parameters. Operator-supplied
+// extraParams may not carry any of these — the builder generates them and
+// RETURNS the security-critical ones (state, PKCE verifier/challenge) to the
+// caller, so an extraParams override would silently diverge the returned
+// values from what the URL/PAR body actually carries (a broken CSRF / PKCE
+// binding). Covers redirect target, client identity, requested response,
+// scope, state, nonce, PKCE challenge, response mode, RAR details, and the
+// JAR request container.
+var RESERVED_AUTHZ_PARAMS = {
+  "response_type":         1,
+  "client_id":             1,
+  "redirect_uri":          1,
+  "scope":                 1,
+  "state":                 1,
+  "nonce":                 1,
+  "code_challenge":        1,
+  "code_challenge_method": 1,
+  "response_mode":         1,
+  "authorization_details": 1,
+  "request":               1,
+  "request_uri":           1,
+};
+
+// Refuse operator-supplied extraParams keys that collide with a framework-
+// managed parameter. extraParams is operator-controlled, so a collision is a
+// config-time bug (a library merge / copy-paste) — refuse it loudly rather
+// than let it shadow a value the framework generated and returned. Fail
+// closed; shared by authorizationUrl, pushAuthorizationRequest, and
+// endSessionUrl so every URL/PAR builder guards the same way.
+function _assertNoReservedExtraParams(extraParams, reserved, errCode, ctx) {
+  if (!extraParams || typeof extraParams !== "object") return;
+  var ek = Object.keys(extraParams);
+  for (var i = 0; i < ek.length; i++) {
+    if (Object.prototype.hasOwnProperty.call(reserved, ek[i])) {
+      throw new OAuthError(errCode,
+        ctx + ": extraParams key '" + ek[i] + "' collides with a " +
+        "framework-managed parameter — pass it through the named option instead");
+    }
+  }
+}
+
 // ---- core ----
 
 function create(opts) {
@@ -1259,7 +1306,14 @@ function create(opts) {
       params.set("authorization_details", JSON.stringify(requestedAuthzDetails));
     }
     // Operator-supplied additional params (audience, resource, etc.).
+    // Refuse keys that collide with a framework-managed parameter so an
+    // operator typo / library-merge can't shadow the redirect_uri / state /
+    // code_challenge the builder generated and returned — which would
+    // silently diverge the returned {state, verifier} from the URL and
+    // break the CSRF / PKCE binding.
     if (uopts.extraParams && typeof uopts.extraParams === "object") {
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_AUTHZ_PARAMS,
+        "auth-oauth/reserved-extra-param", "authorizationUrl");
       var ek = Object.keys(uopts.extraParams);
       for (var i = 0; i < ek.length; i++) params.set(ek[i], String(uopts.extraParams[ek[i]]));
     }
@@ -1371,23 +1425,30 @@ function create(opts) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "refreshAccessToken: checkAndInsert() callback threw: " + ((e && e.message) || String(e)));
       }
-      // Spec contract: inserted===true → first sighting (OK);
-      // inserted===false → replay. v0.9.3 had this inverted, which
-      // broke every first refresh attempt for operators reusing an
-      // existing b.nonceStore-style backend.
-      alreadySeen = inserted === false;
+      // Spec contract: a TRUTHY result → first sighting (the value was
+      // inserted, OK); a FALSY result → replay. v0.9.3 had this inverted,
+      // which broke every first refresh attempt for operators reusing an
+      // existing b.nonceStore-style backend. Test truthiness, not an
+      // `=== false` literal: a store fronting Redis SETNX / SQL INSERT
+      // returns 0 (falsy, not `false`) when the row already existed, so
+      // an exact-literal compare would miss the replay and fail OPEN.
+      alreadySeen = !inserted;
     } else if (typeof ropts.seen === "function") {
       // Legacy non-atomic path. Documented as a check-then-act race;
       // operators sharing a single-writer store (Redis SETNX, DB
       // INSERT ON CONFLICT) MUST migrate to checkAndInsert. Stays
       // here for backwards-compat with existing operator code.
+      // Legacy contract: truthy → the token was presented before (replay).
+      // The value is used by truthiness at the gate below, so a store
+      // returning 1 from Redis EXISTS / a SQL COUNT is honored as "seen"
+      // instead of being missed by an `=== true` literal compare.
       try { alreadySeen = await ropts.seen(refreshToken); }
       catch (e) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "refreshAccessToken: seen() callback threw: " + ((e && e.message) || String(e)));
       }
     }
-    if (alreadySeen === true) {
+    if (alreadySeen) {
       throw new OAuthError("auth-oauth/refresh-token-replay",
         "refreshAccessToken: refresh token has been presented before — refused " +
         "(OAuth 2.1 §6.1 / RFC 9700 §4.13 one-time-use defense). The operator MUST " +
@@ -2010,15 +2071,10 @@ function create(opts) {
         "ui_locales":                 1,
         "client_id":                  1,
       };
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_END_SESSION_PARAMS,
+        "auth-oauth/end-session-reserved-extra-param", "endSessionUrl");
       var ek = Object.keys(uopts.extraParams);
-      for (var i = 0; i < ek.length; i++) {
-        if (RESERVED_END_SESSION_PARAMS[ek[i]]) {
-          throw new OAuthError("auth-oauth/end-session-reserved-extra-param",
-            "endSessionUrl: extraParams key '" + ek[i] + "' collides with a first-class " +
-            "RP-Init Logout parameter — pass it through the named field instead");
-        }
-        params.set(ek[i], String(uopts.extraParams[ek[i]]));
-      }
+      for (var i = 0; i < ek.length; i++) params.set(ek[i], String(uopts.extraParams[ek[i]]));
     }
     var qs = params.toString();
     if (qs.length === 0) return endpoint;
@@ -2106,6 +2162,11 @@ function create(opts) {
         : JSON.stringify(requestedAuthzDetails);   // form param — JSON string
     }
     if (uopts.extraParams && typeof uopts.extraParams === "object") {
+      // Same reserved-key guard as authorizationUrl — a PAR request pushes
+      // the identical security-critical parameter set, so extraParams may
+      // not shadow redirect_uri / state / code_challenge here either.
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_AUTHZ_PARAMS,
+        "auth-oauth/reserved-extra-param", "pushAuthorizationRequest");
       var ek = Object.keys(uopts.extraParams);
       for (var i = 0; i < ek.length; i++) authzParams[ek[i]] = String(uopts.extraParams[ek[i]]);
     }
@@ -2352,7 +2413,10 @@ function create(opts) {
           "verifyBackchannelLogoutToken: atomicReplayStore.checkAndInsert threw: " +
           ((e && e.message) || String(e)));
       }
-      if (inserted === false) {
+      // Fail closed on ANY non-truthy result. A store fronting SETNX / an
+      // ON-CONFLICT INSERT returns 0 (falsy, not `false`) on a duplicate,
+      // so an `=== false` compare would miss the replay.
+      if (!inserted) {
         throw new OAuthError("auth-oauth/logout-token-replay",
           "verifyBackchannelLogoutToken: jti '" + claims.jti +
           "' already seen — replay refused (atomic)");
@@ -2368,7 +2432,10 @@ function create(opts) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "verifyBackchannelLogoutToken: seen() callback threw: " + ((e && e.message) || String(e)));
       }
-      if (first === false) {
+      // Fail closed on ANY non-truthy result — `seen()` returns truthy the
+      // first time it sees the (jti, iss) pair; a store returning 0 for a
+      // duplicate must still refuse, which an `=== false` compare would miss.
+      if (!first) {
         throw new OAuthError("auth-oauth/logout-token-replay",
           "verifyBackchannelLogoutToken: jti already seen — replay refused");
       }

package/lib/auth/oid4vci.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.oid4vci

package/lib/auth/oid4vp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.oid4vp

package/lib/auth/openid-federation.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.openidFederation

package/lib/auth/passkey.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Passkey / WebAuthn (FIDO2) — registration + authentication primitives.

package/lib/auth/password.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Argon2id password hashing — public framework primitive.

package/lib/auth/saml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.saml
@@ -1050,7 +1052,7 @@ function create(opts) {
         "parseLogoutRequest: inflate failed: " + ((e && e.message) || String(e)));
     }
     // Verify the redirect-binding signature when an IdP key is supplied.
-    if (vopts.idpVerifyKey) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutRequest")) {
       if (typeof vopts.queryString !== "string") {
         throw new AuthError("auth-saml/no-query-string",
           "parseLogoutRequest: idpVerifyKey requires queryString (raw URL query)");
@@ -1238,7 +1240,7 @@ function create(opts) {
       throw new AuthError("auth-saml/bad-saml-response",
         "parseLogoutResponse: inflate failed: " + ((e && e.message) || String(e)));
     }
-    if (vopts.idpVerifyKey) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutResponse")) {
       if (typeof vopts.queryString !== "string") {
         throw new AuthError("auth-saml/no-query-string",
           "parseLogoutResponse: idpVerifyKey requires queryString");
@@ -1410,7 +1412,7 @@ function create(opts) {
         "parseLogoutRequestPost: samlRequestB64 must be a non-empty string");
     }
     var xml = Buffer.from(samlRequestB64, "base64").toString("utf8");
-    if (vopts.idpVerifyKey || vopts.idpVerifyAlg) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutRequestPost")) {
       _verifyEmbeddedXmlDsig(xml, vopts.idpVerifyKey, vopts.idpVerifyAlg, "LogoutRequest");
     }
     var c14n = xmlC14n();
@@ -1532,7 +1534,7 @@ function create(opts) {
         "parseLogoutResponseSoap: soap:Body is empty");
     }
     var innerXml = Buffer.from(c14n.canonicalize(inner)).toString("utf8");
-    if (vopts.idpVerifyKey || vopts.idpVerifyAlg) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutResponseSoap")) {
       _verifyEmbeddedXmlDsig(innerXml, vopts.idpVerifyKey, vopts.idpVerifyAlg, "LogoutResponse");
     }
     var innerLocal = inner.name.split(":").pop();
@@ -1864,8 +1866,31 @@ function _embedXmlDsig(bodyXml, refId, signingKey, signingAlg) {
   return bodyXml.substring(0, splitAt) + sigEl + bodyXml.substring(splitAt);
 }
 
+// SLO verification-config gate. Presence of EITHER idpVerifyKey or
+// idpVerifyAlg signals the operator intends to verify the inbound
+// message; a half-supplied pair is a configuration error, never a
+// license to skip the signature check. Returns true when both are
+// present (verify), false when neither is (verification not requested),
+// and throws — fail closed — when exactly one is present, so a
+// fat-fingered verifier can never silently accept a forged, unsigned
+// LogoutRequest / LogoutResponse. Every SLO parse path (HTTP-Redirect,
+// HTTP-POST, SOAP) routes its verify decision through this one gate so
+// the redirect and back-channel bindings agree on fail-closed behavior.
+function _verifyConfig(idpVerifyKey, idpVerifyAlg, ctx) {
+  if (!idpVerifyKey && !idpVerifyAlg) return false;
+  if (!idpVerifyKey) {
+    throw new AuthError("auth-saml/no-verify-key",
+      ctx + ": idpVerifyAlg supplied without idpVerifyKey — verification cannot proceed");
+  }
+  if (!idpVerifyAlg) {
+    throw new AuthError("auth-saml/no-verify-alg",
+      ctx + ": idpVerifyKey supplied without idpVerifyAlg (alg is required when key is supplied)");
+  }
+  return true;
+}
+
 function _verifyEmbeddedXmlDsig(xml, idpVerifyKey, idpVerifyAlg, expectedRootLocal) {
-  if (!idpVerifyKey || !idpVerifyAlg) return;
+  if (!_verifyConfig(idpVerifyKey, idpVerifyAlg, "_verifyEmbeddedXmlDsig")) return;
   var sigAlgUrn = _sigAlgUrn(idpVerifyAlg);
   if (!sigAlgUrn) {
     throw new AuthError("auth-saml/bad-verify-alg",

package/lib/auth/sd-jwt-vc-disclosure.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * SD-JWT VC disclosure encoding/decoding helper.

package/lib/auth/sd-jwt-vc-holder.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.sdJwtVc.holder — operator-side holder/wallet helper.

package/lib/auth/sd-jwt-vc-issuer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.sdJwtVc.issuer — operator-side SD-JWT VC issuer factory.

package/lib/auth/sd-jwt-vc.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.sdJwtVc — Selective Disclosure JWT for Verifiable Credentials

package/lib/auth/status-list.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OAuth Token Status List (draft-ietf-oauth-status-list-20).

package/lib/auth/step-up-policy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Step-up policy DSL — compose RFC 9470 step-up requirements as a

package/lib/auth/step-up.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * RFC 9470 — OAuth 2.0 Step-Up Authentication Challenge.

package/lib/auth-bot-challenge.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.authBotChallenge

package/lib/auth-header.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.authHeader

package/lib/backup/bundle.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * backup-bundle — produce an encrypted backup bundle on disk.

package/lib/backup/crypto.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * backup-crypto — passphrase-based symmetric crypto for backup files.

package/lib/backup/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.backup
@@ -1176,7 +1178,19 @@ function bundleAdapterStorage(opts) {
       "the adapter — the wrap layer composes only with tar / tar.gz bundles. Per-file " +
       "encryption for directory format is a future patch alongside the _crypto-base.js refactor.");
   }
+  // Mirror create()'s ambient-posture read (see the create() encryption
+  // gate above): an explicit opts.posture wins, but when it is unset the
+  // globally-pinned compliance posture (b.compliance.set(...)) still drives
+  // the encryption-required gate. Without this fallback a deployment that
+  // pins HIPAA / PCI-DSS once and constructs the store with the documented
+  // default ({ adapter }, cryptoStrategy defaulting to "none") slips a
+  // plaintext bundle store past a gate create() enforces on encrypt:false —
+  // an asymmetric fail-open under the same regulated posture.
   var posture = opts.posture;
+  if (posture === undefined || posture === null) {
+    try { posture = compliance().current(); }
+    catch (_e) { posture = null; }                                                  // compliance optional at construction time
+  }
   if (posture && BACKUP_ENCRYPTION_REQUIRED_POSTURES.indexOf(posture) !== -1) {
     if (cryptoStrategy === "none") {
       throw new BackupError("backup/posture-requires-encryption",

package/lib/backup/manifest.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * backup-manifest — schema + validation for backup bundle manifests.

package/lib/base32.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.base32

package/lib/boot-gates.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.bootGates

package/lib/bounded-map.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * bounded-map — a Map facade that caps its entry count.

package/lib/breach-deadline.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.breach.deadline + b.breach.report — US state breach-notification

package/lib/break-glass.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.breakGlass

package/lib/budr.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.budr

package/lib/bundler.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.bundler

package/lib/cache-redis.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Redis-backed cache backend for b.cache.

package/lib/cache-status.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.cacheStatus

package/lib/cache.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.cache

package/lib/calendar.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module    b.calendar

package/lib/canonical-json.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.canonicalJson

package/lib/cbor.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.cbor

package/lib/cdn-cache-control.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.cdnCacheControl

package/lib/cert.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.cert

package/lib/chain-writer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.chainWriter

package/lib/circuit-breaker.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.circuitBreaker

package/lib/cli-helpers.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.cliHelpers

package/lib/cli.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * cli — the engine behind `blamejs` on the command line.
@@ -346,6 +348,44 @@ function _coerceList(val) {
   return Array.isArray(val) ? val.slice() : [val];
 }
 
+// Compile one operator-supplied `dev --ignore` pattern to a RegExp,
+// refusing (with a CliError the caller converts to exit 2) any pattern
+// that is over-length, a ReDoS catastrophic-backtracking shape, or one
+// RegExp() itself can't compile. Every refusal shape raises the same
+// CliError type so a single caller-side catch takes the standard
+// exit-2 + stderr path.
+function _compileIgnorePattern(s) {
+  var str = String(s);
+  if (str.length > MAX_IGNORE_PATTERN_LENGTH) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern exceeds max length " +
+      MAX_IGNORE_PATTERN_LENGTH + " (got " + str.length + ")");
+  }
+  // ReDoS / catastrophic-backtracking defense — refuses nested-quant
+  // (CVE-2024-21538 class), consecutive-* (CVE-2026-26996), nested
+  // extglob (CVE-2026-33671), and lookaround-quant shapes before the
+  // pattern reaches RegExp(). Operator typo / hostile-input identical
+  // shape from here on — both want the same refusal.
+  try {
+    guardRegex.sanitize(str, { profile: "strict" });
+  } catch (e) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern refused by guardRegex: " +
+      ((e && e.message) || String(e)));
+  }
+  // A pattern that clears the ReDoS screen can still be un-compilable
+  // (unbalanced group, dangling quantifier). RegExp() throws a
+  // SyntaxError here — route it through the same refusal, not up to a
+  // main() rejection.
+  try {
+    return RegExp(str);
+  } catch (e) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern is not a valid regular expression: " +
+      ((e && e.message) || String(e)));
+  }
+}
+
 async function _runDev(args, ctx) {
   if (args.flags.help || args.flags.h) {
     _writeLine(ctx.stdout, DEV_USAGE);
@@ -359,27 +399,24 @@ async function _runDev(args, ctx) {
   }
   var argList   = _coerceList(args.flags.arg).map(String);
   var watchList = _coerceList(args.flags.watch).map(String);
-  var ignoreList = _coerceList(args.flags.ignore).map(function (s) {
-    var str = String(s);
-    if (str.length > MAX_IGNORE_PATTERN_LENGTH) {
-      throw new CliError("cli/bad-ignore-pattern",
-        "blamejs dev: --ignore pattern exceeds max length " +
-        MAX_IGNORE_PATTERN_LENGTH + " (got " + str.length + ")");
-    }
-    // ReDoS / catastrophic-backtracking defense — refuses nested-quant
-    // (CVE-2024-21538 class), consecutive-* (CVE-2026-26996), nested
-    // extglob (CVE-2026-33671), and lookaround-quant shapes before the
-    // pattern reaches RegExp(). Operator typo / hostile-input identical
-    // shape from here on — both want the same refusal.
-    try {
-      guardRegex.sanitize(str, { profile: "strict" });
-    } catch (e) {
-      throw new CliError("cli/bad-ignore-pattern",
-        "blamejs dev: --ignore pattern refused by guardRegex: " +
-        ((e && e.message) || String(e)));
+  // --ignore validation is operator-input validation, not an internal
+  // fault: a refused pattern must take the same exit-2 + stderr path
+  // every other dev flag uses, never reject main()'s awaited promise
+  // (the bin shim would surface a rejection as a stack trace + exit 1).
+  // The per-pattern helper raises a CliError for the three refusal
+  // shapes — over-length, guardRegex-refused, and an un-compilable
+  // RegExp — and the catch below converts any of them to the standard
+  // refusal path; a non-CliError (a genuine internal fault) re-throws.
+  var ignoreList;
+  try {
+    ignoreList = _coerceList(args.flags.ignore).map(_compileIgnorePattern);
+  } catch (e) {
+    if (e && e.isCliError) {
+      _writeLine(ctx.stderr, e.message || String(e));
+      return 2;
     }
-    return RegExp(str);
-  });
+    throw e;
+  }
   var graceMs = args.flags["grace-ms"] !== undefined ? Number(args.flags["grace-ms"]) : undefined;
   if (graceMs !== undefined && (!Number.isFinite(graceMs) || graceMs < 0)) {
     _writeLine(ctx.stderr, "blamejs dev: --grace-ms must be a non-negative number");

package/lib/client-hints.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.clientHints

package/lib/cloud-events.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.cloudEvents

package/lib/cluster-provider-db.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Default cluster-coordination provider — DB-row-based leader election.